CVE-2015-8925

Published: Sep 20, 2016Modified: May 6, 2026

5.5

Vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

The readline function in archive_read_support_format_mtree.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (invalid read) via a crafted mtree file, related to newline parsing.

Affected (8)

Products: Canonical: Ubuntu Linux · Libarchive: Libarchive · Suse: Linux Enterprise Desktop, Linux Enterprise Server, Linux Enterprise Software Development Kit

1 product

1 product

3 products

Linux Enterprise Desktop

Linux Enterprise Server

Linux Enterprise Software Development Kit

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 12.04
Canonical Ubuntu Linux	Version 14.04
Canonical Ubuntu Linux	Version 15.10
Canonical Ubuntu Linux	Version 16.04

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Libarchive Libarchive	Up to 3.1.901a

Configuration C

3 vulnerable

Vulnerable Software	Affected Versions
Suse Linux Enterprise Desktop	Version 12 sp1
Suse Linux Enterprise Server	Version 12 sp1
Suse Linux Enterprise Software Development Kit	Version 12 sp1

Related CWEs

CWE-125

Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

References (22)

http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00025.html

Source: cve@mitre.org

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2016-1844.html

Source: cve@mitre.org

http://www.debian.org/security/2016/dsa-3657

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2016/06/17/2

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2016/06/17/5

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html

Source: cve@mitre.org

http://www.securityfocus.com/bid/91306

Source: cve@mitre.org

http://www.ubuntu.com/usn/USN-3033-1

Source: cve@mitre.org

Third Party Advisory

https://blog.fuzzing-project.org/47-Many-invalid-memory-access-issues-in-libarchive.html

Source: cve@mitre.org

Third Party Advisory

https://github.com/libarchive/libarchive/issues/516

Source: cve@mitre.org

ExploitIssue TrackingThird Party Advisory

https://security.gentoo.org/glsa/201701-03

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00025.html